6.3. Mixed Practice Questions
1. A SIEM alert fires on an outbound HTTPS connection from an internal server to an IP in an eastern European country. The connection occurs every 8 minutes, 24 hours a day, including weekends. The server hosts a legacy application with no scheduled maintenance jobs. What is the MOST likely explanation?
a) The server is performing legitimate time synchronization with a regional NTP server
b) The server is exhibiting beaconing behavior consistent with C2 malware communication
c) The server is running automated vulnerability scan checks against the external IP
d) The legacy application is performing license validation with the vendor's server
Answer: B. Regular interval, persistent connection to external IP, continuous including off-hours with no legitimate explanation = classic beaconing pattern. NTP uses UDP port 123, not HTTPS. Vulnerability scans are outbound to many IPs, not one. License validation would be irregular, not every 8 minutes.
2. A credentialed Nessus scan finds a Critical RCE vulnerability (CVSS 9.8) on a Windows server. Investigation reveals: the vulnerable service is installed but currently disabled; the server is on an isolated network segment with no internet access; and the server hosts a non-critical internal reporting tool. A non-credentialed scan of the same server finds no critical findings. Which remediation priority is MOST appropriate?
a) Emergency patch within 24 hours — Critical CVSS always requires immediate action
b) Patch within standard Critical SLO (7 days) — CVSS score drives the timeline
c) Downgrade to High priority — disabled service and network isolation reduce exploitability
d) Accept the risk indefinitely — the isolated network means there is no risk
Answer: C. Context significantly reduces risk: disabled service (can't be exploited remotely), network isolation (no path from internet), and non-critical asset. Not A or B — CVSS alone doesn't determine priority. Not D — risk acceptance must be documented and the service could be re-enabled accidentally; the vulnerability should still be tracked and remediated.
3. During incident response, an analyst confirms a workstation is infected with malware. The SOC manager instructs the analyst to immediately re-image the system to eradicate the malware. What critical IR step is being skipped?
a) Containment — the system should be isolated before any changes
b) Evidence acquisition — forensic data must be collected before re-imaging destroys it
c) Notification — regulatory bodies must be informed before remediation begins
d) Root cause analysis — the attack vector must be identified before eradication
Answer: B. Re-imaging destroys all forensic evidence on the system (running processes, RAM, file system artifacts, logs). Evidence must be collected before remediation. A is wrong — containment (isolation) should already be done before this decision point. C is wrong — notification timing depends on the incident type, not a prerequisite to eradication. D is wrong — RCA happens post-incident, not before eradication.
4. An analyst receives a threat intelligence report stating that an APT group is targeting organizations in their sector using spear-phishing emails with malicious Office macros. The intelligence was published 18 months ago. Which confidence dimension is most degraded?
a) Accuracy — the source may have been unreliable
b) Relevancy — the APT group may have changed tactics
c) Timeliness — the intelligence is too old to be operationally current
d) Completeness — not enough detail about the specific macro type
Answer: C. Timeliness is the explicit issue — 18-month-old intelligence about specific TTPs is likely stale. The APT group may have changed delivery mechanisms, infrastructure, or targets. Accuracy (source reliability) isn't indicated as a problem. Relevancy (sector match) appears fine. Completeness isn't a confidence dimension tested by CySA+.
5. A web application accepts user input for a search field and constructs a SQL query by concatenating the input directly: "SELECT * FROM products WHERE name = '" + userInput + "'". Which TWO controls would MOST effectively prevent SQL injection exploitation? (Choose two.)
a) Input validation to reject inputs containing SQL keywords
b) Parameterized queries (prepared statements)
c) Web Application Firewall (WAF) with SQL injection signatures
d) Output encoding of the search results page
e) Stored procedure implementation that uses parameterized inputs
Answer: B and E. Both parameterized queries (B) and stored procedures with parameterized inputs (E) separate SQL code from data at the database driver level, making injection structurally impossible. A (input validation with keyword blacklist) is easily bypassed. C (WAF) can be bypassed by encoding or obfuscation and should not be the primary defense. D (output encoding) prevents XSS, not SQL injection.
